[v6.6] divide error in comedi_inc_scan_progress (2)
0 views
Skip to first unread message
syzbot
Nov 5, 2025, 3:13:33 AM (22 hours ago) Nov 5
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 0a805b6ea8cd Linux 6.6.116
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=152e8a92580000
kernel config: https://syzkaller.appspot.com/x/.config?x=12606d4b8832c7e4
dashboard link: https://syzkaller.appspot.com/bug?extid=bb6180f965618f0f7b31
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/13874446b4b2/disk-0a805b6e.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/69a5e59e1ade/vmlinux-0a805b6e.xz
kernel image: https://storage.googleapis.com/syzbot-assets/322c0711f976/bzImage-0a805b6e.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+bb6180...@syzkaller.appspotmail.com
divide error: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 14374 Comm: syz.0.2448 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RIP: 0010:comedi_inc_scan_progress+0x1a2/0x430 drivers/comedi/drivers.c:562
Code: b6 0c 19 84 c9 0f 85 b8 01 00 00 03 45 34 4c 8d a5 88 00 00 00 4c 89 e1 48 c1 e9 03 0f b6 0c 19 84 c9 0f 85 c7 01 00 00 31 d2 <41> f7 34 24 41 89 17 45 89 ec eb 0f e8 0d a7 8a f9 48 bb 00 00 00
RSP: 0018:ffffc90000007a00 EFLAGS: 00010046
RAX: 0000000000000001 RBX: dffffc0000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff88805dba6200 R08: ffff88805dba6200 R09: 00000000000000ff
R10: dffffc0000000000 R11: fffff52001831201 R12: ffff88805dba6288
R13: 0000000000000002 R14: 0000000000000000 R15: ffff88805dba6234
FS: 00007fa18785e6c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055a5b37ef950 CR3: 0000000036183000 CR4: 00000000003506f0
Call Trace:
<IRQ>
comedi_buf_write_samples+0x372/0x5d0 drivers/comedi/comedi_buf.c:646
das16m1_handler+0x213/0x4b0 drivers/comedi/drivers/das16m1.c:413
das16m1_interrupt+0xab/0x180 drivers/comedi/drivers/das16m1.c:470
__handle_irq_event_percpu+0x276/0x930 kernel/irq/handle.c:158
handle_irq_event_percpu kernel/irq/handle.c:193 [inline]
handle_irq_event+0x8b/0x1e0 kernel/irq/handle.c:210
handle_edge_irq+0x247/0xb30 kernel/irq/chip.c:831
generic_handle_irq_desc include/linux/irqdesc.h:161 [inline]
handle_irq arch/x86/kernel/irq.c:240 [inline]
__common_interrupt+0x13b/0x230 arch/x86/kernel/irq.c:259
common_interrupt+0x5d/0xd0 arch/x86/kernel/irq.c:249
asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:678
RIP: 0010:variable_ffs arch/x86/include/asm/bitops.h:319 [inline]
RIP: 0010:handle_softirqs+0x1b0/0x820 kernel/softirq.c:566
Code: 89 64 24 2c 0f b7 db 48 c7 c7 a0 b5 a9 8a e8 d7 4c 1d 09 65 66 c7 05 bd 20 b2 7e 00 00 e8 78 5b 3a 00 fb 49 c7 c6 c0 a0 a0 8c <89> 5c 24 34 b8 ff ff ff ff 0f bc 44 24 34 41 89 c5 41 ff c5 0f 84
RSP: 0018:ffffc90000007e40 EFLAGS: 00000286
RAX: 4ac8035db1dac500 RBX: 0000000000000202 RCX: 4ac8035db1dac500
RDX: dffffc0000000000 RSI: ffffffff8aaabce0 RDI: ffffffff8afc6b00
RBP: ffffc90000007f50 R08: ffffffff90da8557 R09: 1ffffffff21b50aa
R10: dffffc0000000000 R11: fffffbfff21b50ab R12: 000000000000000a
R13: 0000000000000000 R14: ffffffff8ca0a0c0 R15: ffff88802444da00
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xc7/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0xa9/0x110 kernel/locking/spinlock.c:194
Code: 74 05 e8 ea 7c 13 f7 48 c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f6 44 24 21 02 75 4b f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 <e8> f2 f8 e2 f6 65 8b 05 e3 41 8b 75 85 c0 74 3c 48 c7 04 24 0e 36
RSP: 0018:ffffc90004917a40 EFLAGS: 00000206
RAX: 4ac8035db1dac500 RBX: 0000000000000a06 RCX: 4ac8035db1dac500
RDX: dffffc0000000000 RSI: ffffffff8aaabce0 RDI: 0000000000000001
RBP: ffffc90004917ad0 R08: ffffffff90da8557 R09: 1ffffffff21b50aa
R10: dffffc0000000000 R11: fffffbfff21b50ab R12: dffffc0000000000
R13: dffffc0000000000 R14: ffffffff971d8d40 R15: 1ffff92000922f48
spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
autoconfig drivers/tty/serial/8250/8250_port.c:1307 [inline]
serial8250_config_port+0x2697/0x39c0 drivers/tty/serial/8250/8250_port.c:3221
univ8250_config_port+0x3b5/0x960 drivers/tty/serial/8250/8250_core.c:445
uart_do_autoconfig drivers/tty/serial/serial_core.c:1204 [inline]
uart_ioctl+0xddf/0xfb0 drivers/tty/serial/serial_core.c:1603
tty_ioctl+0x926/0xdd0 drivers/tty/tty_io.c:2779
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:871 [inline]
__se_sys_ioctl+0xfd/0x170 fs/ioctl.c:857
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fa18698f6c9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fa18785e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fa186be5fa0 RCX: 00007fa18698f6c9
RDX: 0000000000000000 RSI: 0000000000005453 RDI: 0000000000000003
RBP: 00007fa186a11f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fa186be6038 R14: 00007fa186be5fa0 R15: 00007ffdc86c3978
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:comedi_inc_scan_progress+0x1a2/0x430 drivers/comedi/drivers.c:562
Code: b6 0c 19 84 c9 0f 85 b8 01 00 00 03 45 34 4c 8d a5 88 00 00 00 4c 89 e1 48 c1 e9 03 0f b6 0c 19 84 c9 0f 85 c7 01 00 00 31 d2 <41> f7 34 24 41 89 17 45 89 ec eb 0f e8 0d a7 8a f9 48 bb 00 00 00
RSP: 0018:ffffc90000007a00 EFLAGS: 00010046
RAX: 0000000000000001 RBX: dffffc0000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff88805dba6200 R08: ffff88805dba6200 R09: 00000000000000ff
R10: dffffc0000000000 R11: fffff52001831201 R12: ffff88805dba6288
R13: 0000000000000002 R14: 0000000000000000 R15: ffff88805dba6234
FS: 00007fa18785e6c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055a5b37ef950 CR3: 0000000036183000 CR4: 00000000003506f0
----------------
Code disassembly (best guess):
0: b6 0c mov $0xc,%dh
2: 19 84 c9 0f 85 b8 01 sbb %eax,0x1b8850f(%rcx,%rcx,8)
9: 00 00 add %al,(%rax)
b: 03 45 34 add 0x34(%rbp),%eax
e: 4c 8d a5 88 00 00 00 lea 0x88(%rbp),%r12
15: 4c 89 e1 mov %r12,%rcx
18: 48 c1 e9 03 shr $0x3,%rcx
1c: 0f b6 0c 19 movzbl (%rcx,%rbx,1),%ecx
20: 84 c9 test %cl,%cl
22: 0f 85 c7 01 00 00 jne 0x1ef
28: 31 d2 xor %edx,%edx
* 2a: 41 f7 34 24 divl (%r12) <-- trapping instruction
2e: 41 89 17 mov %edx,(%r15)
31: 45 89 ec mov %r13d,%r12d
34: eb 0f jmp 0x45
36: e8 0d a7 8a f9 call 0xf98aa748
3b: 48 rex.W
3c: bb .byte 0xbb
3d: 00 00 add %al,(%rax)
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: 0a805b6ea8cd Linux 6.6.116
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=152e8a92580000
kernel config: https://syzkaller.appspot.com/x/.config?x=12606d4b8832c7e4
dashboard link: https://syzkaller.appspot.com/bug?extid=bb6180f965618f0f7b31
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/13874446b4b2/disk-0a805b6e.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/69a5e59e1ade/vmlinux-0a805b6e.xz
kernel image: https://storage.googleapis.com/syzbot-assets/322c0711f976/bzImage-0a805b6e.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+bb6180...@syzkaller.appspotmail.com
divide error: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 14374 Comm: syz.0.2448 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RIP: 0010:comedi_inc_scan_progress+0x1a2/0x430 drivers/comedi/drivers.c:562
Code: b6 0c 19 84 c9 0f 85 b8 01 00 00 03 45 34 4c 8d a5 88 00 00 00 4c 89 e1 48 c1 e9 03 0f b6 0c 19 84 c9 0f 85 c7 01 00 00 31 d2 <41> f7 34 24 41 89 17 45 89 ec eb 0f e8 0d a7 8a f9 48 bb 00 00 00
RSP: 0018:ffffc90000007a00 EFLAGS: 00010046
RAX: 0000000000000001 RBX: dffffc0000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff88805dba6200 R08: ffff88805dba6200 R09: 00000000000000ff
R10: dffffc0000000000 R11: fffff52001831201 R12: ffff88805dba6288
R13: 0000000000000002 R14: 0000000000000000 R15: ffff88805dba6234
FS: 00007fa18785e6c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055a5b37ef950 CR3: 0000000036183000 CR4: 00000000003506f0
Call Trace:
<IRQ>
comedi_buf_write_samples+0x372/0x5d0 drivers/comedi/comedi_buf.c:646
das16m1_handler+0x213/0x4b0 drivers/comedi/drivers/das16m1.c:413
das16m1_interrupt+0xab/0x180 drivers/comedi/drivers/das16m1.c:470
__handle_irq_event_percpu+0x276/0x930 kernel/irq/handle.c:158
handle_irq_event_percpu kernel/irq/handle.c:193 [inline]
handle_irq_event+0x8b/0x1e0 kernel/irq/handle.c:210
handle_edge_irq+0x247/0xb30 kernel/irq/chip.c:831
generic_handle_irq_desc include/linux/irqdesc.h:161 [inline]
handle_irq arch/x86/kernel/irq.c:240 [inline]
__common_interrupt+0x13b/0x230 arch/x86/kernel/irq.c:259
common_interrupt+0x5d/0xd0 arch/x86/kernel/irq.c:249
asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:678
RIP: 0010:variable_ffs arch/x86/include/asm/bitops.h:319 [inline]
RIP: 0010:handle_softirqs+0x1b0/0x820 kernel/softirq.c:566
Code: 89 64 24 2c 0f b7 db 48 c7 c7 a0 b5 a9 8a e8 d7 4c 1d 09 65 66 c7 05 bd 20 b2 7e 00 00 e8 78 5b 3a 00 fb 49 c7 c6 c0 a0 a0 8c <89> 5c 24 34 b8 ff ff ff ff 0f bc 44 24 34 41 89 c5 41 ff c5 0f 84
RSP: 0018:ffffc90000007e40 EFLAGS: 00000286
RAX: 4ac8035db1dac500 RBX: 0000000000000202 RCX: 4ac8035db1dac500
RDX: dffffc0000000000 RSI: ffffffff8aaabce0 RDI: ffffffff8afc6b00
RBP: ffffc90000007f50 R08: ffffffff90da8557 R09: 1ffffffff21b50aa
R10: dffffc0000000000 R11: fffffbfff21b50ab R12: 000000000000000a
R13: 0000000000000000 R14: ffffffff8ca0a0c0 R15: ffff88802444da00
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xc7/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0xa9/0x110 kernel/locking/spinlock.c:194
Code: 74 05 e8 ea 7c 13 f7 48 c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f6 44 24 21 02 75 4b f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 <e8> f2 f8 e2 f6 65 8b 05 e3 41 8b 75 85 c0 74 3c 48 c7 04 24 0e 36
RSP: 0018:ffffc90004917a40 EFLAGS: 00000206
RAX: 4ac8035db1dac500 RBX: 0000000000000a06 RCX: 4ac8035db1dac500
RDX: dffffc0000000000 RSI: ffffffff8aaabce0 RDI: 0000000000000001
RBP: ffffc90004917ad0 R08: ffffffff90da8557 R09: 1ffffffff21b50aa
R10: dffffc0000000000 R11: fffffbfff21b50ab R12: dffffc0000000000
R13: dffffc0000000000 R14: ffffffff971d8d40 R15: 1ffff92000922f48
spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
autoconfig drivers/tty/serial/8250/8250_port.c:1307 [inline]
serial8250_config_port+0x2697/0x39c0 drivers/tty/serial/8250/8250_port.c:3221
univ8250_config_port+0x3b5/0x960 drivers/tty/serial/8250/8250_core.c:445
uart_do_autoconfig drivers/tty/serial/serial_core.c:1204 [inline]
uart_ioctl+0xddf/0xfb0 drivers/tty/serial/serial_core.c:1603
tty_ioctl+0x926/0xdd0 drivers/tty/tty_io.c:2779
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:871 [inline]
__se_sys_ioctl+0xfd/0x170 fs/ioctl.c:857
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fa18698f6c9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fa18785e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fa186be5fa0 RCX: 00007fa18698f6c9
RDX: 0000000000000000 RSI: 0000000000005453 RDI: 0000000000000003
RBP: 00007fa186a11f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fa186be6038 R14: 00007fa186be5fa0 R15: 00007ffdc86c3978
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:comedi_inc_scan_progress+0x1a2/0x430 drivers/comedi/drivers.c:562
Code: b6 0c 19 84 c9 0f 85 b8 01 00 00 03 45 34 4c 8d a5 88 00 00 00 4c 89 e1 48 c1 e9 03 0f b6 0c 19 84 c9 0f 85 c7 01 00 00 31 d2 <41> f7 34 24 41 89 17 45 89 ec eb 0f e8 0d a7 8a f9 48 bb 00 00 00
RSP: 0018:ffffc90000007a00 EFLAGS: 00010046
RAX: 0000000000000001 RBX: dffffc0000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff88805dba6200 R08: ffff88805dba6200 R09: 00000000000000ff
R10: dffffc0000000000 R11: fffff52001831201 R12: ffff88805dba6288
R13: 0000000000000002 R14: 0000000000000000 R15: ffff88805dba6234
FS: 00007fa18785e6c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055a5b37ef950 CR3: 0000000036183000 CR4: 00000000003506f0
----------------
Code disassembly (best guess):
0: b6 0c mov $0xc,%dh
2: 19 84 c9 0f 85 b8 01 sbb %eax,0x1b8850f(%rcx,%rcx,8)
9: 00 00 add %al,(%rax)
b: 03 45 34 add 0x34(%rbp),%eax
e: 4c 8d a5 88 00 00 00 lea 0x88(%rbp),%r12
15: 4c 89 e1 mov %r12,%rcx
18: 48 c1 e9 03 shr $0x3,%rcx
1c: 0f b6 0c 19 movzbl (%rcx,%rbx,1),%ecx
20: 84 c9 test %cl,%cl
22: 0f 85 c7 01 00 00 jne 0x1ef
28: 31 d2 xor %edx,%edx
* 2a: 41 f7 34 24 divl (%r12) <-- trapping instruction
2e: 41 89 17 mov %edx,(%r15)
31: 45 89 ec mov %r13d,%r12d
34: eb 0f jmp 0x45
36: e8 0d a7 8a f9 call 0xf98aa748
3b: 48 rex.W
3c: bb .byte 0xbb
3d: 00 00 add %al,(%rax)
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
Reply all
Reply to author
Forward
0 new messages